I removed the routers that are forwarding packets to the Cain sniffer and moved the sniffer to a laptop. I tested the Cain & Abel sniffer, Wireshark, tcpdump, and tshark against a VPN tunnel using the following protocols: PPTP, L2TP/IPSec, MSKerb5, and OpenVPN.

From this, I deduce that the Cain & Abel sniffer works on a switched environment.

I made an attempt to run the Cain & Abel sniffer on an unencrypted (L2TP/IPSec VPN) test network and it worked! It also successfully detected the NAS and my laptop using WEP encryption. I believe this is the cause of my problems since I am using the ASA to decrypt the packets before the Cain sniffer can capture them.

The ASA only forwards the ETHER_IP (MAC address) and the L2TP or IPSec protocol. Or try one of the virtual PC programs from Microsoft, they somewhat virtualize Windows in a different way.So why am I getting strange packet capture results when I run the sniffer on my router? I noticed that my ASA and ASA router do not forward the whole packet. Get some of the vmware images online to run Windows inside of a virtual machine, it might take a while to reinstall a new copy of XP inside the VM. Sure it'll be annoying but once you feel the program is safe you can move it to your working PC or turn down the antivirus warnings a bit. You should also run antivirus in its strongest protection mode, make it confirm every program name change, file deletes, creates, etc. I have heard that itunes doesn't like to be run under a debugger but a packet monitor, huh. I've never seen a program that doesn't like packet monitors, sounds like a suspicious program. If you're on wifi then you'll see all the traffic. Sometimes I disconnect the Internet and start up a packet monitor on another PC and put it on the same wire (use a hub not a switch). Are both packet capture programs relying on winpcap, is that what's being detected? There's a site called AnalogX that has a network monitor that might not be detected. It might help you continuously run 'netstat -ano' and cross check the new processes that show up and what ports and ip addresses they are connecting too.

Ip sniffer